Vallejo's redeveloped industrial sites put many independent tenants on top of shared, legacy building infrastructure - and the building-automation systems are the soft underbelly. CyberFortify runs manual network, cloud, web and API penetration tests here, aligned to NIST CSF, the NIST 800-82 OT guidance, IEC 62443 and SOC 2. Delivered remotely from our Gulf base on a daily overlap window, with on-site work where a tester genuinely needs to be on the wire. Fixed price, audit-ready reporting, free retest.
// 01 Why Vallejo businesses need penetration testing
Mare Island tells the story of this city's security problem in one place. A former naval shipyard is now a mixed-use campus of manufacturers, biotech labs, film stages and offices - dozens of independent tenants sharing buildings, risers and utilities that were wired for a very different owner. The tenants changed; much of the infrastructure underneath them did not.
That pattern repeats across Vallejo's adaptive-reuse sites. HVAC, power distribution, access control, elevators, fire and life-safety all run on building-automation systems installed years apart, remotely managed by outside vendors, and sitting on networks that were never segmented from tenant IT. A compromise of the BMS is not an inconvenience - it can unlock doors, manipulate the environmental controls a cleanroom or cold-chain depends on, or provide a quiet pivot from one tenant into another who believed they were isolated.
Scanning does not surface that class of risk. A scanner flags an unpatched server; it cannot tell you that a BACnet controller answers to anyone on the building VLAN, that a vendor's remote-management gateway shares one password across the campus, or that the automation network and a tenant's lab live on the same flat subnet. Those are architecture and trust decisions, and confirming them takes a tester who understands both the control protocols and the landlord-tenant relationships layered on top.
// 02 Compliance and regulatory drivers in Vallejo
Multi-tenant industrial sites answer to industrial-security standards for the building systems and to whatever regulated data their tenants carry across the shared fabric. These are the requirements we most often map evidence against.
NIST SP 800-82
The federal guidance for securing industrial and building control systems. We map BMS/BAS findings to its controls so facilities teams can evidence a defensible OT security posture.
IEC 62443 - zones & conduits
The zones-and-conduits model applied to building systems: proving that automation, tenant IT and safety networks are separated by controlled conduits rather than sharing one flat network.
NIST CSF & CIS Controls
Site operators and tenants anchor their wider security programme to NIST CSF and the CIS Controls. Both rest on independent testing to evidence the identify, protect and detect functions.
SOC 2 & ISO 27001
Technology and service tenants selling into enterprise customers face security review before contract. SOC 2 reports and ISO 27001 A.8.29 evidence both rest on independent penetration testing.
HIPAA & PCI DSS v4.0
Where a biotech or clinical tenant holds health data, or any tenant takes card payments, HIPAA and PCI DSS 4.0 Requirement 11.4 travel with that data across the shared infrastructure it rides on.
CCPA / CPRA
California's consumer-privacy regime adds rights, risk-assessment expectations and cybersecurity-audit duties across resident, employee and customer data. Our privacy-regulation guidance sets it in context.
// 03 Penetration testing services for Vallejo
Vallejo engagements weight the network and its trust boundaries over the perimeter, because that is where building OT and tenant IT collide. Network and segmentation testing lead; cloud follows, since vendor portals and integration platforms live there; web and API cover the tenant applications riding the same links.
Network pen testing
Building-automation and OT network review - BACnet and Modbus exposure, controller and supervisor access, plus segmentation checks between automation, tenant and safety zones.
Cloud pen testing
Identity, tenant isolation and exposure across the vendor portals and cloud platforms that remotely manage building systems and tenant workloads.
Web application pen testing
Facility dashboards, tenant portals and civic applications, tested against the OWASP Top 10, access-control flaws and business-logic abuse.
API pen testing
Integration and telemetry APIs behind building and tenant systems - broken object-level authorisation, token handling and scope enforcement.
Mobile app pen testing
Facility and access-control apps on iOS and Android - local data storage, credential handling and the API traffic that opens doors.
Red teaming
Goal-based adversary simulation - can a foothold on one tenant or a building gateway reach access control, a lab, or another tenant before anyone notices?
// 04 How we deliver to Vallejo
We will not pretend otherwise: CyberFortify is a Gulf-based firm on UTC+3, and Vallejo sits ten to eleven hours behind us. We have no California office and no local staff. What we have is a working pattern built around that gap: our late afternoon and evening is your morning, and we hold that window open daily for stand-ups, live triage and read-outs. Testing continues while Vallejo is offline, so results are waiting when your day starts.
What runs remotely
Cloud, web, API, external and remote-management testing from our secure environment - the vendor portals, tenant applications and internet-facing services that hold most of the scope. Findings land in a shared channel as confirmed, and critical issues are escalated immediately.
What we do on-site
Building-automation, internal network, wireless and segmentation testing where a tester genuinely needs to be on the OT wire, plus workshops with facilities and tenant security teams. We travel when it adds value and say so when it does not.
Every engagement opens with a free 30-minute scoping call and a fixed-price quote within the hour. For live building systems we agree test windows that never risk HVAC, life-safety or a tenant's production, and a free retest proves the fixes.
// 05 Industries we secure in Vallejo
Vallejo's risk profile is shaped by adaptive-reuse industrial campuses, a working ferry and transit link, and a base of biotech, media and municipal services.
// 06 Our methodology
Vallejo engagements follow the same audit-defensible process we run everywhere, tuned to building automation and shared infrastructure. Testing is grounded in PTES and NIST SP 800-115, with OT work mapped to NIST 800-82 and IEC 62443, exploitation aligned to MITRE ATT&CK - including the ATT&CK for ICS matrix - and application work driven by OWASP. As a CREST Accreditation Pathway firm we lead with manual testing - automation supports the tester, never replaces one, and we never point aggressive tooling at a live controller.
Scoping & rules of engagement
Building systems, tenant boundaries, OT zones, test accounts and hard no-touch limits for life-safety agreed in writing first.
Fixed quote in 1hReconnaissance & threat modelling
Attack surface mapped around the shared fabric - which controllers, vendors and tenants touch which network, and where a pivot between them would run.
ATT&CK for ICSManual exploitation
Weaknesses exploited and chained under controlled conditions, with cross-tenant and OT-to-IT pivots proven safely - never by disrupting a live building or plant.
Safe, controlledReporting & free retest
Executive summary, CVSS-scored detail and mapping to NIST 800-82, IEC 62443, NIST CSF, SOC 2 or a tenant's own framework - plus a free retest once fixes ship.
Audit-ready// 07 Why CyberFortify for Vallejo
A scan-and-report vendor
Automated output rebadged as a penetration test, blind to control protocols and trust boundaries, unable to reason about a BACnet controller or whether one tenant can reach another across the building network.
CyberFortify
A Gulf-based, CREST-pathway team candid about the time difference and structured around it. Manual exploitation aimed at building automation, shared infrastructure and the segmentation between tenants, findings mapped to your assessors' frameworks, fixed pricing and a free retest.
Vallejo engagements most often pair a network and segmentation assessment with a cloud penetration test, since a site's risk splits between the building OT on the wire and the vendor portals that manage it remotely. Where a compromise could halt a tenant's production or unlock a facility, we add red teaming to test whether the pivot is detected before it lands.
// 08 Frequently asked questions
Do you test building-automation and BMS/BAS systems at Vallejo's multi-tenant sites?
Yes - it is the reason most Vallejo sites call us. We test the building-management systems that run HVAC, power, access control, elevators and life-safety: exposed BACnet and Modbus controllers, engineering workstations and vendor gateways, default or shared credentials, and whether a device on the building network can issue commands it should never be trusted with. We confirm exposure by reaching a controller or its supervisor from where an attacker would actually sit, never by disrupting a live plant or lab.
How do you test whether one tenant can reach another across shared building infrastructure?
We treat the shared fabric - the building OT network, the risers, the common utilities and the vendor-managed systems - as its own target rather than assuming each tenant is isolated. We test the segmentation between building OT and tenant IT, and between tenants who believe they are separate: whether a foothold in the automation VLAN pivots into a lab or office network, whether flat addressing lets a compromised HVAC controller talk to a cleanroom, and whether a shared vendor account opens doors across the whole campus. We test from a hostile tenant, a compromised contractor laptop and a rogue device on the building network.
Which standards and regulations drive penetration testing for Vallejo industrial sites?
Building and industrial OT is measured against NIST SP 800-82 and the zones-and-conduits model from IEC 62443, with NIST CSF and the CIS Controls framing the wider programme. Where a tenant handles regulated data on shared infrastructure the duties travel with it: HIPAA for a clinical or biotech tenant, PCI DSS 4.0 Requirement 11.4 for card handlers, and SOC 2 where enterprise customers demand assurance. CCPA/CPRA adds consumer-privacy and risk-assessment obligations across the non-clinical data the site holds.
With your team in the Gulf, how does the time gap work for a Vallejo engagement?
We should be plain: CyberFortify is a Gulf-based firm on UTC+3, ten to eleven hours ahead of Vallejo, with no California office or local staff. We hold a deliberate daily overlap window open - our late afternoon and evening is your morning - reserved for stand-ups, live triage and read-outs. Testing continues while your building and tenant teams are offline, so findings are usually waiting when the Vallejo day begins.
How fast can we get a quote for a Vallejo engagement?
Book a free 30-minute scoping call and we return a fixed-price quote, usually within the hour and always within one business day. The report is written to hand straight to an auditor or a tenant asking for assurance, and a remediation retest is included once your fixes ship.